/*
 * Based on arch/arm/mm/fault.c
 *
 * Copyright (C) 1995  Linus Torvalds
 * Copyright (C) 1995-2004 Russell King
 * Copyright (C) 2012 ARM Ltd.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
#include <utils/types.h>
#include <utils/list.h>
#include <seminix/spinlock.h>
#include <seminix/pgtable.h>
#include <seminix/thread.h>
#include <seminix/extable.h>
#include <seminix/smp.h>
#include <asm/insn.h>
#include <asm/traps.h>
#include <asm/daifflags.h>
#include <asm/system_misc.h>
#include <asm/debug.h>

struct fault_info {
    int	(*fn)(unsigned long addr, unsigned int esr,
              struct pt_regs *regs);
    int	sig;
    int	code;
    const char *name;
};

static const struct fault_info fault_info[];
static struct fault_info debug_fault_info[];

static inline const struct fault_info *esr_to_fault_info(unsigned int esr)
{
    return fault_info + (esr & ESR_ELx_FSC);
}

static inline const struct fault_info *esr_to_debug_fault_info(unsigned int esr)
{
    return debug_fault_info + DBG_ESR_EVT(esr);
}

static void data_abort_decode(unsigned int esr)
{
    pr_alert("Data abort info:\n");

    if (esr & ESR_ELx_ISV) {
        pr_alert("  Access size = %u byte(s)\n",
             1U << ((esr & ESR_ELx_SAS) >> ESR_ELx_SAS_SHIFT));
        pr_alert("  SSE = %lu, SRT = %lu\n",
             (esr & ESR_ELx_SSE) >> ESR_ELx_SSE_SHIFT,
             (esr & ESR_ELx_SRT_MASK) >> ESR_ELx_SRT_SHIFT);
        pr_alert("  SF = %lu, AR = %lu\n",
             (esr & ESR_ELx_SF) >> ESR_ELx_SF_SHIFT,
             (esr & ESR_ELx_AR) >> ESR_ELx_AR_SHIFT);
    } else {
        pr_alert("  ISV = 0, ISS = 0x%08lx\n", esr & ESR_ELx_ISS_MASK);
    }

    pr_alert("  CM = %lu, WnR = %lu\n",
         (esr & ESR_ELx_CM) >> ESR_ELx_CM_SHIFT,
         (esr & ESR_ELx_WNR) >> ESR_ELx_WNR_SHIFT);
}

static void mem_abort_decode(unsigned int esr)
{
    pr_alert("Mem abort info:\n");

    pr_alert("  ESR = 0x%08x\n", esr);
    pr_alert("  Exception class = %s, IL = %u bits\n",
         esr_get_class_string(esr),
         (esr & ESR_ELx_IL) ? 32 : 16);
    pr_alert("  SET = %lu, FnV = %lu\n",
         (esr & ESR_ELx_SET_MASK) >> ESR_ELx_SET_SHIFT,
         (esr & ESR_ELx_FnV) >> ESR_ELx_FnV_SHIFT);
    pr_alert("  EA = %lu, S1PTW = %lu\n",
         (esr & ESR_ELx_EA) >> ESR_ELx_EA_SHIFT,
         (esr & ESR_ELx_S1PTW) >> ESR_ELx_S1PTW_SHIFT);

    if (esr_is_data_abort(esr))
        data_abort_decode(esr);
}

static inline bool is_ttbr0_addr(unsigned long addr)
{
    /* entry assembly clears tags for TTBR0 addrs */
    return addr < TASK_SIZE;
}

static inline bool is_ttbr1_addr(unsigned long addr)
{
    /* TTBR1 addresses may have a tag if KASAN_SW_TAGS is in use */
    return addr >= VA_START;
}

/*
 * Dump out the page tables associated with 'addr' in the currently active mm.
 */
static void show_pte(unsigned long addr)
{
    struct mm_struct *mm;
    pgd_t *pgdp;
    pgd_t pgd;

    if (is_ttbr0_addr(addr)) {
        /* TTBR0 */
        mm = current->mm;
        if (mm == &init_mm) {
            pr_alert("[%016lx] user address but mm is swapper\n",
                 addr);
            return;
        }
    } else if (is_ttbr1_addr(addr)) {
        /* TTBR1 */
        mm = &init_mm;
    } else {
        pr_alert("[%016lx] address between user and kernel address ranges\n",
             addr);
        return;
    }

    pr_alert("%s pgtable: %luk pages, %u-bit VAs, pgdp = %p\n",
         mm == &init_mm ? "swapper" : "user", UTILS_PAGE_SIZE / SZ_1K,
         mm == &init_mm ? VA_BITS : (int) vabits_user, mm->pgd);
    pgdp = pgd_offset(mm->pgd, addr);
    pgd = READ_ONCE(*pgdp);
    pr_alert("[%016lx] pgd=%016llx", addr, pgd_val(pgd));

    do {
        p4d_t *p4dp, p4d;
        pud_t *pudp, pud;
        pmd_t *pmdp, pmd;
        pte_t *ptep, pte;

        if (pgd_none(pgd) || pgd_bad(pgd))
            break;

        p4dp = p4d_offset(pgdp, addr);
        p4d = READ_ONCE(*p4dp);
        pr_cont(", p4d=%016llx", p4d_val(p4d));
        if (p4d_none(p4d) || p4d_bad(p4d))
            break;

        pudp = pud_offset(p4dp, addr);
        pud = READ_ONCE(*pudp);
        pr_cont(", pud=%016llx", pud_val(pud));
        if (pud_none(pud) || pud_bad(pud))
            break;

        pmdp = pmd_offset(pudp, addr);
        pmd = READ_ONCE(*pmdp);
        pr_cont(", pmd=%016llx", pmd_val(pmd));
        if (pmd_none(pmd) || pmd_bad(pmd))
            break;

        ptep = pte_offset_map(pmdp, addr);
        pte = READ_ONCE(*ptep);
        pr_cont(", pte=%016llx", pte_val(pte));
        pte_unmap(ptep);
    } while(0);

    pr_cont("\n");
}

static bool is_el1_instruction_abort(unsigned int esr)
{
    return ESR_ELx_EC(esr) == ESR_ELx_EC_IABT_CUR;
}

static inline bool is_el1_permission_fault(unsigned long addr, unsigned int esr,
                       struct pt_regs *regs)
{
    unsigned int ec       = ESR_ELx_EC(esr);
    unsigned int fsc_type = esr & ESR_ELx_FSC_TYPE;

    if (ec != ESR_ELx_EC_DABT_CUR && ec != ESR_ELx_EC_IABT_CUR)
        return false;

    if (fsc_type == ESR_ELx_FSC_PERM)
        return true;

    if (is_ttbr0_addr(addr) && system_uses_ttbr0_pan())
        return fsc_type == ESR_ELx_FSC_FAULT &&
            (regs->pstate & PSR_PAN_BIT);

    return false;
}

static void die_kernel_fault(const char *msg, unsigned long addr,
                 unsigned int esr, struct pt_regs *regs)
{
    pr_alert("Unable to handle kernel %s at virtual address %016lx\n", msg,
         addr);

    mem_abort_decode(esr);

    show_pte(addr);
    die("Oops", regs, esr);

    unreachable();
}

static void __do_kernel_fault(unsigned long addr, unsigned int esr,
                  struct pt_regs *regs)
{
    const char *msg;

    /*
     * Are we prepared to handle this kernel fault?
     * We are almost certainly not prepared to handle instruction faults.
     */
    if (!is_el1_instruction_abort(esr) && fixup_exception(regs))
        return;

    if (is_el1_permission_fault(addr, esr, regs)) {
        if (esr & ESR_ELx_WNR)
            msg = "write to read-only memory";
        else
            msg = "read from unreadable memory";
    } else if (addr < UTILS_PAGE_SIZE) {
        msg = "NULL pointer dereference";
    } else {
        msg = "paging request";
    }

    die_kernel_fault(msg, addr, esr, regs);
}

static void set_thread_esr(unsigned long address, unsigned int esr)
{
    current->thread.fault_address = address;

    /*
     * If the faulting address is in the kernel, we must sanitize the ESR.
     * From userspace's point of view, kernel-only mappings don't exist
     * at all, so we report them as level 0 translation faults.
     * (This is not quite the way that "no mapping there at all" behaves:
     * an alignment fault not caused by the memory type would take
     * precedence over translation fault for a real access to empty
     * space. Unfortunately we can't easily distinguish "alignment fault
     * not caused by memory type" from "alignment fault caused by memory
     * type", so we ignore this wrinkle and just return the translation
     * fault.)
     */
    if (!is_ttbr0_addr(current->thread.fault_address)) {
        switch (ESR_ELx_EC(esr)) {
        case ESR_ELx_EC_DABT_LOW:
            /*
             * These bits provide only information about the
             * faulting instruction, which userspace knows already.
             * We explicitly clear bits which are architecturally
             * RES0 in case they are given meanings in future.
             * We always report the ESR as if the fault was taken
             * to EL1 and so ISV and the bits in ISS[23:14] are
             * clear. (In fact it always will be a fault to EL1.)
             */
            esr &= ESR_ELx_EC_MASK | ESR_ELx_IL |
                ESR_ELx_CM | ESR_ELx_WNR;
            esr |= ESR_ELx_FSC_FAULT;
            break;
        case ESR_ELx_EC_IABT_LOW:
            /*
             * Claim a level 0 translation fault.
             * All other bits are architecturally RES0 for faults
             * reported with that DFSC value, so we clear them.
             */
            esr &= ESR_ELx_EC_MASK | ESR_ELx_IL;
            esr |= ESR_ELx_FSC_FAULT;
            break;
        default:
            /*
             * This should never happen (entry.S only brings us
             * into this code for insn and data aborts from a lower
             * exception level). Fail safe by not providing an ESR
             * context record at all.
             */
            WARN(1, "ESR 0x%x is not DABT or IABT from EL0\n", esr);
            esr = 0;
            break;
        }
    }

    current->thread.fault_code = esr;
}

static void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *regs)
{
    /*
     * If we are in kernel mode at this point, we have no context to
     * handle this fault with.
     */
    if (user_mode(regs)) {
        const struct fault_info *inf = esr_to_fault_info(esr);

        set_thread_esr(addr, esr);
        arm64_force_sig_fault(inf->sig, inf->code, (void __user *)addr,
                      inf->name);
    } else {
        __do_kernel_fault(addr, esr, regs);
    }
}

static inline bool is_el0_instruction_abort(unsigned int esr)
{
    return ESR_ELx_EC(esr) == ESR_ELx_EC_IABT_LOW;
}

static int do_page_fault(unsigned long addr, unsigned int esr,
                   struct pt_regs *regs)
{
    if (is_ttbr0_addr(addr) && is_el1_permission_fault(addr, esr, regs)) {

        /* regs->orig_addr_limit may be 0 if we entered from EL0 */
        if (regs->orig_addr_limit == KERNEL_DS)
            die_kernel_fault("access to user memory with fs=KERNEL_DS",
                     addr, esr, regs);
        if (is_el1_instruction_abort(esr))
            die_kernel_fault("execution of user memory",
                     addr, esr, regs);
        if (!search_exception_tables(regs->pc))
            die_kernel_fault("access to user memory outside uaccess routines",
                     addr, esr, regs);
    }

    if (!user_mode(regs) && !search_exception_tables(regs->pc))
        goto no_context;

    return 0;
no_context:
    __do_kernel_fault(addr, esr, regs);
    return 0;
}

static int do_translation_fault(unsigned long addr,
                      unsigned int esr,
                      struct pt_regs *regs)
{
    if (is_ttbr0_addr(addr))
        return do_page_fault(addr, esr, regs);

    do_bad_area(addr, esr, regs);
    return 0;
}

static int do_alignment_fault(unsigned long addr, unsigned int esr,
                  struct pt_regs *regs)
{
    do_bad_area(addr, esr, regs);
    return 0;
}

static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs)
{
    return 1; /* "fault" */
}

static int do_sea(unsigned long addr, unsigned int esr, struct pt_regs *regs)
{
    const struct fault_info *inf;
    void __user *siaddr;

    inf = esr_to_fault_info(esr);

    if (esr & ESR_ELx_FnV)
        siaddr = NULL;
    else
        siaddr  = (void __user *)addr;
    arm64_notify_die(inf->name, regs, inf->sig, inf->code, siaddr, esr);

    return 0;
}

static const struct fault_info fault_info[] = {
    { do_bad,		SIGKILL, SI_KERNEL,	"ttbr address size fault"	},
    { do_bad,		SIGKILL, SI_KERNEL,	"level 1 address size fault"	},
    { do_bad,		SIGKILL, SI_KERNEL,	"level 2 address size fault"	},
    { do_bad,		SIGKILL, SI_KERNEL,	"level 3 address size fault"	},
    { do_translation_fault,	SIGSEGV, SEGV_MAPERR,	"level 0 translation fault"	},
    { do_translation_fault,	SIGSEGV, SEGV_MAPERR,	"level 1 translation fault"	},
    { do_translation_fault,	SIGSEGV, SEGV_MAPERR,	"level 2 translation fault"	},
    { do_translation_fault,	SIGSEGV, SEGV_MAPERR,	"level 3 translation fault"	},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 8"			},
    { do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 1 access flag fault"	},
    { do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 2 access flag fault"	},
    { do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 3 access flag fault"	},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 12"			},
    { do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 1 permission fault"	},
    { do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 2 permission fault"	},
    { do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 3 permission fault"	},
    { do_sea,		SIGBUS,  BUS_OBJERR,	"synchronous external abort"	},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 17"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 18"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 19"			},
    { do_sea,		SIGKILL, SI_KERNEL,	"level 0 (translation table walk)"	},
    { do_sea,		SIGKILL, SI_KERNEL,	"level 1 (translation table walk)"	},
    { do_sea,		SIGKILL, SI_KERNEL,	"level 2 (translation table walk)"	},
    { do_sea,		SIGKILL, SI_KERNEL,	"level 3 (translation table walk)"	},
    { do_sea,		SIGBUS,  BUS_OBJERR,	"synchronous parity or ECC error" },	// Reserved when RAS is implemented
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 25"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 26"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 27"			},
    { do_sea,		SIGKILL, SI_KERNEL,	"level 0 synchronous parity error (translation table walk)"	},	// Reserved when RAS is implemented
    { do_sea,		SIGKILL, SI_KERNEL,	"level 1 synchronous parity error (translation table walk)"	},	// Reserved when RAS is implemented
    { do_sea,		SIGKILL, SI_KERNEL,	"level 2 synchronous parity error (translation table walk)"	},	// Reserved when RAS is implemented
    { do_sea,		SIGKILL, SI_KERNEL,	"level 3 synchronous parity error (translation table walk)"	},	// Reserved when RAS is implemented
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 32"			},
    { do_alignment_fault,	SIGBUS,  BUS_ADRALN,	"alignment fault"		},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 34"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 35"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 36"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 37"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 38"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 39"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 40"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 41"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 42"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 43"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 44"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 45"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 46"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 47"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"TLB conflict abort"		},
    { do_bad,		SIGKILL, SI_KERNEL,	"Unsupported atomic hardware update fault"	},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 50"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 51"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"implementation fault (lockdown abort)" },
    { do_bad,		SIGBUS,  BUS_OBJERR,	"implementation fault (unsupported exclusive)" },
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 54"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 55"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 56"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 57"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 58" 			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 59"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 60"			},
    { do_bad,		SIGKILL, SI_KERNEL,	"section domain fault"		},
    { do_bad,		SIGKILL, SI_KERNEL,	"page domain fault"		},
    { do_bad,		SIGKILL, SI_KERNEL,	"unknown 63"			},
};

asmlinkage void __exception do_mem_abort(unsigned long addr, unsigned int esr,
                     struct pt_regs *regs)
{
    const struct fault_info *inf = esr_to_fault_info(esr);

    if (!inf->fn(addr, esr, regs))
        return;

    if (!user_mode(regs)) {
        pr_alert("Unhandled fault at 0x%016lx\n", addr);
        mem_abort_decode(esr);
        show_pte(addr);
    }

    arm64_notify_die(inf->name, regs,
        inf->sig, inf->code, (void __user *)addr, esr);
}

asmlinkage void __exception do_el0_ia_bp_hardening(unsigned long addr,
                           unsigned int esr,
                           struct pt_regs *regs)
{
    local_daif_restore(DAIF_PROCCTX);
    do_mem_abort(addr, esr, regs);
}

asmlinkage void __exception do_sp_pc_abort(unsigned long addr,
                       unsigned int esr,
                       struct pt_regs *regs)
{
    if (user_mode(regs))
        local_daif_restore(DAIF_PROCCTX);

    arm64_notify_die("SP/PC alignment exception", regs,
             SIGBUS, BUS_ADRALN, (void __user *)addr, esr);
}

static struct fault_info debug_fault_info[] = {
    { do_bad,	SIGTRAP,	TRAP_HWBKPT,	"hardware breakpoint"	},
    { do_bad,	SIGTRAP,	TRAP_HWBKPT,	"hardware single-step"	},
    { do_bad,	SIGTRAP,	TRAP_HWBKPT,	"hardware watchpoint"	},
    { do_bad,	SIGKILL,	SI_KERNEL,	"unknown 3"		},
    { do_bad,	SIGTRAP,	TRAP_BRKPT,	"aarch32 BKPT"		},
    { do_bad,	SIGKILL,	SI_KERNEL,	"aarch32 vector catch"	},
    { early_brk64,	SIGTRAP,	TRAP_BRKPT,	"aarch64 BRK"		},
    { do_bad,	SIGKILL,	SI_KERNEL,	"unknown 7"		},
};

void __init hook_debug_fault_code(int nr,
                  int (*fn)(unsigned long, unsigned int, struct pt_regs *),
                  int sig, int code, const char *name)
{
    BUG_ON(nr < 0 || nr >= (int)ARRAY_SIZE(debug_fault_info));

    debug_fault_info[nr].fn		= fn;
    debug_fault_info[nr].sig	= sig;
    debug_fault_info[nr].code	= code;
    debug_fault_info[nr].name	= name;
}

asmlinkage int __exception do_debug_exception(unsigned long addr,
                          unsigned int esr,
                          struct pt_regs *regs)
{
    const struct fault_info *inf = esr_to_debug_fault_info(esr);
    int rv;

    if (!inf->fn(addr, esr, regs)) {
        rv = 1;
    } else {
        arm64_notify_die(inf->name, regs,
                 inf->sig, inf->code, (void __user *)addr, esr);
        rv = 0;
    }

    return rv;
}
